Discourse/discourse
Discourse/discourse
0
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2026-08-07 13:19:19 +08:00
Code Packages Activity Actions
discourse/app/controllers/admin
History
Exact
Roman Rizzi 5bb48ec039 SECURITY: block cross-site backup traversal in multisite local storage [backport 2026.1] 
Backport of #716 to release/2026.1.

---

Harden backup download/delete/restore path handling to prevent path traversal across site backup directories in multisite setups using local backup storage. Tighten backup route matching, validate backup IDs in admin backup member actions, and enforce canonical-path containment in LocalBackupStore so filenames cannot escape the current site’s backup directory. Add regression specs for route matching, controller rejection of traversal IDs, and local store traversal protection.

CVE: https://github.com/discourse/discourse/security/advisories/GHSA-5j6v-4x6g-9pg5
2026-05-19 00:26:55 +01:00
..
config FEATURE: Discourse ID setting page (#36316) 2025-12-11 16:04:09 +01:00
admin_controller.rb DEV: Drop WithServiceHelper 2024-09-05 09:58:20 +02:00
admin_notices_controller.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
api_controller.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
backups_controller.rb SECURITY: block cross-site backup traversal in multisite local storage [backport 2026.1] 2026-05-19 00:26:55 +01:00
badges_controller.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
color_schemes_controller.rb FEATURE: Allow editing theme-owned palettes (#34722) 2025-10-06 09:02:39 +03:00
dashboard_controller.rb FEATURE: Upcoming changes part 1 (#34617) 2025-10-30 10:46:14 +10:00
email_controller.rb FIX: disable smtp_should_reject code 2025-11-25 10:34:35 -05:00
email_logs_controller.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
email_styles_controller.rb
email_templates_controller.rb FEATURE: Add background job and ability to delete posts from suspend user modal (#36813) 2026-01-07 10:25:01 -06:00
embeddable_hosts_controller.rb UX: admins embedding page follows admin ux guideline (#30122) 2025-01-06 13:01:08 +11:00
embedding_controller.rb UX: admins embedding page follows admin ux guideline (#30122) 2025-01-06 13:01:08 +11:00
emoji_controller.rb DEV: Move admin config pages out of /customize/ sub-route (#30511) 2025-01-02 09:13:11 +10:00
form_templates_controller.rb FIX: Process templates before previewing (#33848) 2025-07-29 15:09:02 +08:00
groups_controller.rb DEV: Add dedicated admin groups page (#32377) 2025-04-22 11:23:25 +08:00
impersonate_controller.rb DEV: Allow impersonation without session swapping (#34213) 2025-08-21 14:18:15 +08:00
permalinks_controller.rb FIX: Permalink.create didn't work as expected anymore (#29895) 2024-11-22 21:11:26 +01:00
plugins_controller.rb FIX: Don't allow access to plugin page if plugin is not visible (#26431) 2024-04-02 16:26:15 +03:00
reports_controller.rb SECURITY: Do not leak PM post edits to moderators 2026-03-19 15:46:24 +00:00
robots_txt_controller.rb FIX: Show true content of robots.txt after restoring to default (#24980) 2023-12-20 23:00:37 +03:00
screened_emails_controller.rb SECURITY: Moderators cannot see user emails. 2024-12-19 13:13:18 -03:00
screened_ip_addresses_controller.rb FEATURE: add option to hide IP addresses from moderators (#33682) 2025-08-05 10:09:02 -05:00
screened_urls_controller.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
search_controller.rb FEATURE: Add admin-only reports and centralize report visibility logic 2026-01-28 17:11:14 +00:00
search_logs_controller.rb DEV: Apply syntax_tree formatting to app/* 2023-01-09 14:14:59 +00:00
section_controller.rb DEV: Add a skeleton for section landing page & items (#28477) 2024-10-02 12:19:38 +10:00
site_settings_controller.rb DEV: Allow specifying dependent settings in configuration (#36061) 2025-11-27 13:23:43 +08:00
site_texts_controller.rb FIX: Filter restricted email template keys from site text search (#36857) 2025-12-24 14:33:37 +01:00
staff_action_logs_controller.rb SECURITY: Restrict staff action logs visibility for moderators 2026-01-28 17:11:14 +00:00
staff_controller.rb DEV: Drop WithServiceHelper 2024-09-05 09:58:20 +02:00
themes_controller.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00
unknown_reviewables_controller.rb FEATURE: Gracefully handle unhandled reviewables (#31118) 2025-02-05 14:38:45 +11:00
user_fields_controller.rb FEATURE: Allow hiding user fields on signup form (#34672) 2025-09-15 10:42:07 +08:00
users_controller.rb FEATURE: Add background job and ability to delete posts from suspend user modal (#36813) 2026-01-07 10:25:01 -06:00
versions_controller.rb
watched_words_controller.rb DEV: Refactor watched words to use tracked properties and filtered model (#36010) 2025-11-13 19:56:52 -03:00
web_hooks_controller.rb DEV: Update rubocop-discourse to 3.13 and autofix issues (#35073) 2025-10-06 16:11:01 +02:00